DevSecOps Foundation key terms

Moving security activities earlier in the software delivery lifecycle, so that design reviews, threat modeling, and automated testing happen before code reaches production rather than after release.

A structured review after an incident that focuses on systemic causes and process gaps rather than punishing individuals, encouraging honest reporting and faster organizational learning.

Developers or operations staff embedded in product teams who receive extra security training and act as the first point of contact for security questions and reviews within their team.

An approach that integrates security practices, tooling, and ownership into DevOps culture and automation, so that security is continuous and shared rather than a separate gate at the end.

Protecting the automated build, test, and deployment chain itself, including runner isolation, secret handling, artifact signing, and restricting who can modify pipeline definitions.

A structured exercise that identifies assets, entry points, adversaries, and possible attack paths for a system, then records mitigations before or during design.

Expressing security requirements, policies, and controls as versioned machine-readable artifacts, such as policy files or infrastructure templates, that can be tested and enforced automatically.

Encoding organizational security and compliance rules in a declarative language so that automated engines can evaluate systems against them consistently and block noncompliant changes.

Static analysis of declarative infrastructure templates to detect misconfigurations such as public storage buckets, overly permissive firewall rules, or unencrypted volumes before deployment.

Managing risk from third-party components, build systems, and distribution channels, including dependency tracking, provenance verification, and integrity checks on artifacts.

A machine-readable inventory of the components and dependencies contained in a software product, used to trace vulnerable or unlicensed libraries quickly when new advisories appear.

Cryptographically signing build outputs so consumers can verify that a package was produced by an authorized pipeline and has not been altered since it was built.

The practice of storing, distributing, rotating, and auditing credentials such as API keys and certificates in a dedicated vault rather than in code, configuration files, or environment variables.

Granting an identity only the permissions required to perform its current task, for only as long as needed, and removing access when the task is complete.

An authorization model where permissions are bundled into roles and identities are assigned roles, simplifying administration and review of who can do what.

An authorization model that evaluates attributes of the user, resource, action, and environment against policy, enabling finer-grained and context-aware decisions than static roles alone.

Granting elevated permissions temporarily on request with approval and automatic expiry, reducing the window in which standing privileged accounts can be abused.

Requiring two or more independent evidence types, such as a password plus a hardware token, before granting access, so a single stolen credential is insufficient to authenticate.

Trusting an external identity provider to authenticate users and assert their attributes, allowing one set of credentials to access multiple systems without separate accounts.

A non-human identity used by an application, pipeline, or automation to authenticate to other systems, which needs scoped permissions and periodic credential rotation.

Periodically replacing passwords, keys, and certificates on a defined schedule or after suspected exposure, limiting the useful lifetime of a leaked secret.

Analyzing source or compiled code without executing it to find patterns associated with vulnerabilities, such as injection flaws or unsafe cryptographic calls, early in development.

Testing a running application from the outside by sending crafted requests and observing responses, which can reveal runtime and configuration issues that static analysis misses.

Automated inspection of third-party libraries and dependencies against vulnerability and license databases, producing alerts when a component version is known to be risky.

A continuous cycle of discovering, classifying, prioritizing, remediating, and verifying weaknesses across code and infrastructure based on exploitability and business impact.

The average elapsed time between detecting a vulnerability or defect and closing it, used as a metric for how responsive a delivery organization is to security findings.

The sum of entry points and exposed resources through which an adversary could attempt to interact with or compromise a system, including APIs, ports, and identities.

A setting or deployment choice that weakens security, such as open storage permissions, default credentials, or verbose error output, and is a leading cause of cloud breaches.

Layering independent preventive and detective controls so that failure or bypass of any single control does not by itself expose the system to full compromise.

A security model that treats no network location as inherently trusted and instead verifies identity and device posture for every request before granting access to a resource.

A deployment pattern where servers and containers are replaced rather than patched in place, reducing configuration drift and making rollback and reproducibility easier.

Controls that detect or block malicious behavior while an application or workload is executing, such as web application firewalls, sandboxing, or anomaly detection agents.

A maintained record of identified risks with owners, likelihood and impact ratings, planned treatments, and review dates, used to prioritize and track security decisions.

Automated, ongoing evaluation of systems against control requirements so that evidence is generated continuously instead of through periodic manual audits alone.

A tamper-evident chronological record of who did what, when, and from where, retained so that activity can be reconstructed during investigations or compliance reviews.

A platform that centralizes logs from many sources, correlates events against detection rules, and raises alerts for analysts to triage and investigate.

A documented set of roles, communication paths, and phased procedures for detecting, containing, eradicating, and recovering from a security incident, exercised through regular drills.

The collection, transport, normalization, and storage path that moves log data from applications and infrastructure into a central analysis platform with defined retention.